I tip my toes in osquery queries every now and then whenever we have a new rule to add or something to change